Hide sensitive tickets with a checkbox

Notice: This plugin is unmaintained and available for adoption.

Description

This is a plugin that lets users mark tickets as "sensitive" with a checkbox on the ticket form. Sensitive tickets are viewable only to those with the SENSITIVE_VIEW permission. There are the following use cases for this:

Scenario 1

A user submits a security related ticket to a project's Trac, which is generally open to the public. They mark it as "Sensitive" so that only people in the internal team that deal with security issues can see the ticket and the vulnerability is hidden to all other users.

Scenario 2

A team uses Trac to handle its business development tasks, but wants to leave the record open for all. Some tasks, however, are sensitive, for example dealing with difficult clients or prospective clients where negotiations on budgets are still ongoing. Those tickets are marked as sensitive and hidden to others, but viewable by the business development team.

Beware:

• Hooks that send mail on ticket changes will still send mail for sensitive tickets; this may not be what you want.
• In versions of Trac prior to 1.0.2, if the plugin is removed, disabled, or fails to load, Trac will display sensitive tickets ("failing open" instead of "failing closed").

This plugin is supported on Trac 0.11.6 or higher.

The plugin is based on the example ​vulnerability_tickets.py, but uses a checkbox instead of text in the summary or keywords to mark a ticket as sensitive.

See also: PrivateTicketsPlugin.

Bugs/Feature Requests

Existing bugs and feature requests for SensitiveTicketsPlugin are here.

If you have any issues, create a new ticket.

defect	16 / 19
enhancement	3 / 3
task	3 / 3

Download

Download the zipped source from here.

The plugin is also available on ​PyPI (compatible with Trac 1.0+).

Source

You can check out SensitiveTicketsPlugin from here using Subversion, or browse the source​ with Trac.

Installation

General instructions on installing Trac plugins can be found on the TracPlugins page.

Configuration

Once this plugin is enabled, you have to insert it at the appropriate place in your list of permission policies in your trac.ini file:

[trac]
permission_policies = SensitiveTicketsPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy

For Trac 1.2, this will typically be:

[trac]
permission_policies = SensitiveTicketsPolicy, ReadonlyWikiPolicy, DefaultPermissionPolicy, LegacyAttachmentPolicy

Users with SENSITIVE_VIEW privileges will be able to see and act on tickets marked sensitive, as will any user configured to be able to bypass the sensitive marker. For example, this happens in the case the user is the ticket owner or reporter or is in the CC field, and the associated flags are set in [sensitivetickets] section of trac.ini.

This plugin also adds the SENSITIVE_ACTIVITY_VIEW permission, which is narrower in scope than SENSITIVE_VIEW. Accounts with SENSITIVE_ACTIVITY_VIEW will be able to see activity on sensitive material in the timeline, but will only be able to identify it by ticket number, comment number and timestamp. All other content will be redacted. SENSITIVE_ACTIVITY_VIEW can be useful (for example) for providing a notification daemon the ability to tell that some activity happened without leaking the content of that activity.

After installation the Trac project needs an environment upgrade.

Recent Changes

17648 by rjollos on 2020-01-11 06:05:42

TracSensitiveTickets 1.2.4: Add release command

17647 by rjollos on 2020-01-11 06:01:11

TracSensitiveTickets 1.2.4: Make compatible with Trac 1.4

Fixes #13719.

17591 by rjollos on 2019-11-23 19:09:29

TracSensitiveTickets 1.2.4dev: Bump version after release

​pypi:TracSensitiveTickets/1.2.3 has been published.

Fixes #13681.

(more)

Author/Contributors

Authors: sbenthall, dkgdkg
Maintainer: none (needsadoption)
Contributors: k0s, obs